Add support for disabling KDC writes

Add two global ipaConfig options to disable undesirable writes that have
performance impact.
The "KDC:Disable Last Success" will disable writing back to ldap the last
successful AS Request time (successful kinit)
The "KDC:Disable Lockout" will disable completely writing back lockout
related data. This means lockout policies will stop working.

https://fedorahosted.org/freeipa/ticket/2734

ipalib/plugins/config.py

@@ -177,7 +177,8 @@ class config(LDAPObject):
             cli_name='ipaconfigstring',
             label=_('Password plugin features'),
             doc=_('Extra hashes to generate in password plug-in'),
-            values=(u'AllowLMhash', u'AllowNThash'),
+            values=(u'AllowLMhash', u'AllowNThash',
+                    u'KDC:Disable Last Success', u'KDC:Disable Lockout'),
             csv=True,
         ),
         Str('ipaselinuxusermaporder',